Researchers Detailed New Threat-Hunting Techniques to Detect Azure Managed Identity Abuse

Cybersecurity experts have unveiled sophisticated techniques to identify potential abuse of Azure Managed Identities (MIs), addressing a critical but often overlooked security concern in cloud environments.

Azure MIs streamline credential management by eliminating the need for manual secret handling, yet this convenience creates new attack vectors that sophisticated threat actors can exploit to escalate privileges and access sensitive resources.

The techniques, documented in a comprehensive research paper by Team Axon, focus on identifying unauthorized access and malicious use of MIs rather than just detecting their existence.

As these identities are increasingly implemented across Azure services, they present an expanding attack surface that may allow adversaries to pivot across environments, gain unauthorized access to Microsoft Graph, and extract sensitive data from various Azure resources.

Hunters researchers noted that while MIs offer significant security advantages by eliminating static credentials, their potential misuse can be particularly damaging since they operate with the implicit trust of Azure’s authentication framework.

The research builds upon previous work, particularly Karl Fossaen’s DEF CON 32 talk titled “Identity Theft is Not a Joke, Azure!” which initially raised awareness around MI abuse vectors.

The threat-hunting approach detailed in the paper introduces twelve specialized detection queries, each targeting different aspects of potential MI abuse.

These queries range from high-fidelity detections, such as identifying explicit token requests from virtual machines, to broader behavioral analyses that flag when MIs access unusual resources or exhibit anomalous authentication patterns.

One of the most significant techniques presented focuses on detecting Microsoft Graph enumeration activities using compromised MIs.

Detection Method

This high-fidelity detection method identifies when a managed identity makes anomalously high numbers of requests to Microsoft Graph API endpoints – behavior consistent with reconnaissance activity by threat actors who have gained unauthorized access to MI tokens.

The corresponding detection query, implemented in Snowflake SQL, creates a common table expression that identifies suspicious patterns of Graph API access:-

WITH graph_enum_activity AS (
    SELECT MIN(time) AS min_event_time,
        MAX(time) AS max_event_time,
        user_principal_object_id,
        ARRAY_AGG(DISTINCT request_uri) AS distinct_request_uris,
        COUNT(*) AS amount_of_requests
    FROM RAW.MICROSOFT_GRAPH_ACTIVITY_LOGS
    WHERE request_method = 'GET'
    GROUP BY user_principal_object_id, hour_of_events
    HAVING amount_of_requests > 60
    AND amount_of_endpoint_base > 5
    AND amount_of_request_uris > 30
)

The query establishes behavioral thresholds by analyzing request patterns, flagging cases where managed identities make suspicious numbers of distinct calls to the Graph API within a short timeframe.

This detection approach proves particularly effective because legitimate MIs typically display predictable, limited request patterns to Graph resources, making anomalous enumeration attempts stand out.

Beyond detection, the research also details practical guidance for incident investigation and response, including cross-correlation techniques between Azure Sign-in logs, Activity logs, and Microsoft Graph telemetry to trace the full scope of potential compromises.

By providing these detection methodologies, security teams gain vital capabilities to identify potential compromises before attackers can fully exploit their access to cloud environments and sensitive resources.

How SOC Teams Save Time and Effort with ANY.RUN - Live webinar for SOC teams and managers